Langflow Just Hit KEV a Fifth Time. Go Find Yours Before the Sixth.
- Patrick Duggan
- 4 minutes ago
- 5 min read
Yesterday, July 21, CISA added CVE-2026-0770 to the Known Exploited Vulnerabilities catalog. The vulnerable product is Langflow — the open-source, drag-and-drop builder teams use to wire up AI agent and LLM pipelines without writing the orchestration code themselves. This is the fifth time Langflow has landed on the KEV list.
We are not writing this to take a bow. We are writing it because five is a number that means something, and because this is one of the most predictable, most patchable attack surfaces of the year. You do not have to be surprised by the sixth one. Here is the pattern, the receipts, and exactly what to do about it tonight.
Why we get to say "we called it"
On March 21 we published a post with a blunt title: the AI agent builder got owned in twenty hours. It was about Langflow and CVE-2026-33017 — a single unauthenticated HTTP request that turned into full remote code execution on any exposed instance. Twenty hours after the advisory dropped, before any public proof-of-concept existed, attackers had built working exploits from the advisory text alone.
CISA added that same CVE to the KEV catalog on March 25. Our post ran on March 21. That is four days left of KEV — and to be precise about it, that is a lead over the catalog, not over disclosure. The flaw itself was public on March 17. What we did early was name the attack surface, put six active exploiter IPs into our index, and say out loud that this class of tool was going to keep getting hit. It did.
Since then we tracked every turn of it: three CVEs in two weeks in April with the exploiter IPs published, Iran's MuddyWater weaponizing one in June, a Monero miner in July whose command-and-control server had been sitting in our feed since February. Each time, the ecosystem treated the new flaw as a fresh surprise. It was never a surprise. It was the same surface being drilled again.
Now it is five KEV entries deep. That is the story — not any single one of the flaws, but the fact that the number keeps climbing on one product.
The five, and what each one actually does
If you run Langflow, these are the five that carry CISA's active-exploitation stamp. Patch in this order of blast radius.
[CVE-2026-33017](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-33017) — unauthenticated code injection through the public flow-build endpoint. No login, full RCE. This is the one that got weaponized in twenty hours. KEV since March 25.
[CVE-2026-0770](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-0770) — inclusion of functionality from an untrusted control sphere, allowing remote attackers to execute arbitrary code. The newest, KEV since July 21.
[CVE-2026-55255](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-55255) — authorization bypass through a user-controlled key. An authenticated attacker runs any flow belonging to another user by naming the victim's flow ID in the request. KEV since July 7.
[CVE-2025-3248](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2025-3248) — missing authentication. This is the flaw the first agentic-ransomware operation, the one researchers codenamed JADEPUFFER, rode end to end.
[CVE-2025-34291](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2025-34291) — a further code-injection path added earlier in the run.
The through-line: unauthenticated or trivially-authenticated code execution on a service that, by design, holds your model API keys, your data-source credentials, and a Python runtime. That is the worst possible combination to leave exposed, and it is exactly what a visual agent builder is.
The defender playbook — do these tonight
Find it first. Langflow is classic shadow IT. A data scientist stands one up to prototype an agent and it never gets inventoried. Its default listener is port 7860. Scan your own space for it — internal asset inventory, and an external check for anything you have accidentally published. If a Langflow instance is reachable from the internet, treat it as compromised until proven otherwise.
Get off the vulnerable versions. CVE-2026-33017 hits releases up to and including 1.8.2. The later KEV entries reach past that, so the only safe move is the current release, not "one patch back." Upgrade to the latest, then confirm the running version rather than trusting the deploy manifest.
Wall off the build endpoint. The unauthenticated RCE lives on the public flow-build path. Nothing about that endpoint should ever be reachable from the open internet. Put the whole instance behind authentication and a VPN or private network. An agent builder is an internal developer tool; it does not belong on a public IP.
Hunt for the ones already inside. Look for the Langflow process spawning children it has no business spawning — a Python worker launching sh, curl, wget, or a shell one-liner is the signature of code injection landing. Watch for new outbound connections to mining pools; the March Monero campaign is the worked example. Watch for credential access against your model-provider keys and connected data sources.
Pull our feed and block. We publish the exploiter IPs and the proof-of-concept command-and-control domains tied to this surface — including the hardcoded callback domains our harvester pulled straight out of the public exploit repos. They flow into our STIX feed and the IP and domain blocklists. If you consume the feed, the blocking is already done for you; if you do not, the indicators are there to import. Free, no strings — a cash-poor defender should be able to block this without buying anything.
The point
The reason to write this positively is that Langflow is the rare threat you can actually get ahead of. It is not a stealth nation-state implant. It is a known product, with a known and repeating flaw class, on a known port, with five CISA-stamped CVEs telling you precisely where to look. Inventory it, patch it to current, take it off the public internet, and pull the indicators. Do those four things and the sixth KEV entry — because there will be a sixth — cannot touch you.
We flagged this surface in March, twenty hours after the first hit. We would rather you never need the next post. Go find your Langflow instances.
Our Langflow coverage, in order:
March 21 — The AI Agent Builder Got Owned in 20 Hours (the original call)
April 9 — Three Langflow CVEs in Two Weeks. CISA Says Active Exploitation. We Have the IPs.
July 1 — A Monero Miner Rode a Langflow Bug Into AI Servers in March. The C2 Was in Our Feed Since February.
July 12 — Langflow Just Hit the KEV List for the Fourth Time. We Called This Exact Attack Surface in March.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.